1. Learning Objectives LO1 Distinguish between management and auditor’s responsibilities regarding an auditee organization’s internal controls. LO2 Explain why the auditor evaluates an auditee’s internal controls. LO3 Define seven internal control objectives, relating them to the assertions in management’s financial statements. LO4 Describe general and application control activities found in an accounting information system. 1

2. Reasons for Control Evaluation The primary reason for conducting an evaluation of internal control is to give the auditors a basis for determining the nature, timing and extent of the balance audit program.  Examining the business processes provides a structure for the auditor in designing procedures to test controls and financial statement transactions and balances. LO2 2

3. Control Risk The risk that the client’s internal control will not prevent or detect material misstatement.  The auditor does not control this risk.  The auditor’s task is to assess the risk.  High control risk leads to low detection risk.  Requires the auditor to increase substantive testing in order that misstatements are caught. LO2 3

4. Extent of IT Use The extent of IT use needs to be considered in planning the nature, extent and timing of audit procedures.  IT skills may be needed to understand the flow of some transactions.  Nature, timing and extent are all affected by the extent of IT use. LO2 4

5. Need for Specialized Skills All aspects of a client’s computer processing should be considered in determining the need for specialized IT skills.  Audit team members should possess sufficient IT knowledge to know when to call on specialists. LO2 5

6. How Control Risk Assessment Affects the Audit Program The control risk assessment will affect the procedures included in the audit program.  Each procedure should have identifiable characteristics of nature, timing and extent.  Nature refers to audit techniques to be used; timing is a matter of when they are to be performed; and extent is the amount of work to be done. LO2 6

7. How Control Risk Assessment Affects the Audit Program For an entity with poor controls as compared to an entity with good controls:  The nature of tests will have to provide more reliable evidence. This can be more costly.  More testing will take place at year-end than at an interim date. This can delay the audit report, or can prove more costly.  More evidence will have to be gathered, which is much more costly. LO2 7